Hacker News Reader

Comment by NietTim | Hacker News Reader

Holy shit, after seeing these comments I'm never buying synology

I'm not sure that's entirely fair. No internet device is infallible. Other NAS vendors have had similar levels of bugs leading to exploits.

QNap [1], FreeNas [2], WDC [3] and Seagate [4] for example all have their own issues. Added to that, any device that is inscurely configured as default [5] is going to get hacked.

FreeNas is open source. It has exploits, though notably easier for savvy customers to dig into why they got hacked in the first place.

The real question here is why people need to expose their NAS drives to the internet. I personally don't have a fast enough internet connection to make hosting anything useful. Notably I did try and share my photos with friends and family, but the upload on my DSL is so dire it was a painful experience for all involved.

- [1] http://www.cvedetails.com/vendor/10080/Qnap.html - [2] http://www.cvedetails.com/vendor/9964/Freenas.html - [3] http://www.cvedetails.com/product-list/vendor_id-12782/WDC.h... - [4] http://www.cvedetails.com/product-list/vendor_id-11967/Seaga... - [5] http://www.drobospace.com/forums/showthread.php?tid=141894

I do not think Synology has much to do what it happen. A weak password, an out-of-date Synology software and/or an incorrect setup are all caused by the user.

Synology produces very good products at very affordable prices.

Synology has a vulnerability in their closed down software which allows this... how is this not something they have control over?

Also, this is not the first time this has happened to Synology hardware. Sure, bigger companies attract more attacks, but this is incredibly bad.

See [0]. Also see this[1] and this[2].

[0] https://twitter.com/mikeevangelist/status/496322439740424193

[1] http://www.exploit-db.com/exploits/28243/

[2] http://www.synology.com/en-us/support/security

Have this proven to have been the case? ("a vulnerability in their closed down software which allows this"). Could you give me a link? Thanks!

If you are affiliated with Synology you should disclose that.

I see that your account is only 19 hours old.

No affiliation. I am sure my account is not the only one recently created. Merely a coincidence.

I own a DS411J. Really happy with it.

You can see that there has been hacks of synology products, right?

You are trolling me, yes? Next you will say Crytolocker is a Windows vulnerability (that is not to say that Windows does not have vulnerabilities).

The problem is that Synology has historically not been very proactive at informing and educating their users about security threats, including very specific ones like this. A company that specializes in selling advanced network appliances to novice users and non-IT pros has a certain obligation to those users, IMHO.

PayPal has been described as "a fraud detection company that also transfers money." That's how Synology needs to think of themselves.

Reply on news.ycombinator.com